@apifuse/provider-sdk 2.2.0-beta.48 → 2.2.0-beta.49

package/dist/runtime/stealth.js

@@ -1,13 +1,17 @@
 import { createHash } from "node:crypto";
 import { DEFAULT_SMARTPROXY_POOL_SIZE, invalidateProxyResolutionCacheAsync, ProxyResolutionError, policyResolvesRegistryVendorChain, resolvePolicyProxyPoolSpan, resolvePolicyTransportAttemptCap, resolveProxyConfigAsync, vendorFromResolvedSource, } from "../config/loader.js";
 import { SDKError, TransportError } from "../errors.js";
-import { getStealthProfile, getStealthProfileIntentAlias } from "../stealth/profiles.js";
-import { StealthCookieJar } from "./stealth-cookies.js";
+import { DEFAULT_STEALTH_BROWSER, DEFAULT_STEALTH_OS, getStealthProfile, resolveStealthProfileSelection, } from "../stealth/profiles.js";
+import { chrome149HeaderOrder } from "./chrome149-header-order.js";
 import { createProxyAuthIpDeniedError, createProxyEdgeAuthRejectedError, createProxyEdgeTlsRejectedError, createProxyPoolExhaustedError, createProxyPoolStaleError, isProxyAuthIpDeniedMessage, isProxyEdgeAuthRejectedMessage, isProxyEdgeTlsRejectedResponse, isProxyPoolRefreshableError, isProxyPoolStaleMessage, isProxyPoolStaleStatus, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_STALE_CODE, } from "./proxy-errors.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
 import { evaluateRedirectHop, isRedirectStatus, nextRedirectMethod, resolveRedirectUrl, } from "./redirects.js";
 import { isSensitiveKey, normalizeSensitiveParams, redactSensitiveError, redactSensitiveRequestError, redactSensitiveText, redactUrlQueryParams, serializeRequestUrl, } from "./request-options.js";
-export const DEFAULT_PROFILE = "chrome-desktop";
+import { StealthCookieJar } from "./stealth-cookies.js";
+export const DEFAULT_STEALTH_PROFILE = Object.freeze({
+    browser: DEFAULT_STEALTH_BROWSER,
+    os: DEFAULT_STEALTH_OS,
+});
 const MISSING_PROXY_WARNING = "[provider-sdk] Provider requested proxy routing, but no proxy URL was configured. Continuing without proxy.";
 const MAX_POLICY_PROXY_POOL_REFRESHES = 1;
 const PROXY_CONNECT_FAILURE_CODE = "proxy_connect_failed";
@@ -33,19 +37,6 @@ function sensitiveQueryParamNames(url) {
     const query = url.slice(queryStart + 1, fragmentStart === -1 ? undefined : fragmentStart);
     return [...new URLSearchParams(query).keys()].filter(isSensitiveKey);
 }
-const REMOVED_CHROME_PROFILE_NAMES = new Set([
-    "chrome-120",
-    "chrome-124",
-    "chrome-129",
-    "chrome-130",
-    "chrome-131",
-    "chrome-133",
-    "chrome-144",
-    "chrome-146-psk",
-    "chrome-131-psk",
-    "chrome-130-psk",
-    "edge-131",
-]);
 let wreqModulePromise;
 function getWreqModule() {
     if (!wreqModulePromise) {
@@ -94,48 +85,13 @@ function closestWreqProfile(identifier, wreqProfiles) {
     }
     return closest?.name;
 }
-function resolveDefaultWreqProfileMapping() {
-    let profile;
-    try {
-        profile = getStealthProfile(DEFAULT_PROFILE);
-    }
-    catch (error) {
-        throw new SDKError(`Default stealth profile "${DEFAULT_PROFILE}" cannot be mapped to a wreq-js browser profile.`, { cause: error instanceof Error ? error : undefined });
-    }
+export function resolveWreqProfile(selection, wreqProfiles) {
+    const profile = getStealthProfile(selection);
     const identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
-    if (!parseProfileIdentifier(identifier)) {
-        throw new SDKError(`Default stealth profile "${DEFAULT_PROFILE}" cannot be mapped to a wreq-js browser profile.`);
-    }
-    return { identifier, os: profile.platform };
-}
-let defaultWreqProfileMapping;
-function getDefaultWreqProfileMapping() {
-    defaultWreqProfileMapping ??= resolveDefaultWreqProfileMapping();
-    return defaultWreqProfileMapping;
-}
-export function resolveWreqProfile(profileName, wreqProfiles) {
-    if (REMOVED_CHROME_PROFILE_NAMES.has(profileName)) {
-        throw new SDKError(`Unknown stealth profile: ${profileName}`);
-    }
-    let identifier;
-    let os;
-    try {
-        const profile = getStealthProfile(profileName);
-        identifier = profile.tlsClientIdentifier?.toLowerCase() ?? "";
-        os = profile.platform;
-    }
-    catch {
-        // Preserve the previous ctx.stealth.fetch() compatibility behavior: unknown
-        // profile strings still run with the transport default instead of failing
-        // before the request starts. Removed built-in profile aliases above remain
-        // explicit errors so callers do not accidentally pin retired fingerprints.
-        const defaultMapping = getDefaultWreqProfileMapping();
-        identifier = defaultMapping.identifier;
-        os = defaultMapping.os;
-    }
+    const os = profile.os;
     const browser = closestWreqProfile(identifier, wreqProfiles);
     if (!browser) {
-        throw new SDKError(`Stealth profile "${profileName}" cannot be mapped to a wreq-js browser profile.`);
+        throw new SDKError(`Stealth profile ${profile.browser}/${profile.os} cannot be mapped to a wreq-js browser profile.`);
     }
     return { browser, os };
 }
@@ -146,13 +102,302 @@ function headerEntriesFromHeaders(headers) {
     return Array.from(headers.entries());
 }
 function normalizeHeaders(headers) {
-    const normalized = {};
-    for (const [name, value] of Object.entries(headers)) {
+    return Object.fromEntries(normalizedHeaderEntries(headers));
+}
+function trimOuterHttpWhitespace(value) {
+    return value.replace(/^[\t\n\r ]+|[\t\n\r ]+$/g, "");
+}
+function normalizedHeaderEntries(headers) {
+    const entries = [];
+    const indices = new Map();
+    for (const [originalName, originalValue] of Object.entries(headers)) {
+        if (originalValue === undefined)
+            continue;
+        const name = originalName.toLowerCase();
+        const value = (Array.isArray(originalValue) ? originalValue : [originalValue])
+            .map(trimOuterHttpWhitespace)
+            .join(", ");
+        const existingIndex = indices.get(name);
+        if (existingIndex === undefined) {
+            indices.set(name, entries.length);
+            entries.push([name, value]);
+            continue;
+        }
+        const existing = entries[existingIndex];
+        if (existing)
+            existing[1] = `${existing[1]}, ${value}`;
+    }
+    return entries;
+}
+const SDK_OWNED_EXACT_CHROME_HEADERS = new Set([
+    "host",
+    "connection",
+    "user-agent",
+    "sec-ch-ua",
+    "sec-ch-ua-mobile",
+    "sec-ch-ua-platform",
+    "accept-encoding",
+]);
+// Non-pseudo-header order of real Chrome 149. The fixture captures
+// (chrome-ground-truth-capture.json, chrome-extended-capture.json,
+// h1-casing-capture.json) were taken through Playwright's `locale` option, which
+// installs Accept-Language via DevTools next to User-Agent; real Chrome only
+// receives it from //net (URLRequestHttpJob::AddExtraHeaders), after
+// Accept-Encoding and before Cookie, as al-placement-capture.json B/C show.
+const CHROME_HEADER_ORDERS = {
+    navigation: [
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "user-agent",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+        "priority",
+    ],
+    // xhr has no fixed table: it is emulated by chrome149HeaderOrder.
+    post: [
+        "content-length",
+        "sec-ch-ua-platform",
+        "user-agent",
+        "sec-ch-ua",
+        "content-type",
+        "sec-ch-ua-mobile",
+        "accept",
+        "origin",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+        "priority",
+    ],
+};
+const CHROME_H1_HEADER_ORDERS = {
+    navigation: [
+        "host",
+        "connection",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "sec-ch-ua-platform",
+        "upgrade-insecure-requests",
+        "user-agent",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-user",
+        "sec-fetch-dest",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+    xhr: [
+        "host",
+        "connection",
+        "sec-ch-ua-platform",
+        "cache-control",
+        "x-requested-with",
+        "user-agent",
+        "sec-ch-ua",
+        "sec-ch-ua-mobile",
+        "accept",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+    post: [
+        "host",
+        "connection",
+        "content-length",
+        "sec-ch-ua-platform",
+        "user-agent",
+        "sec-ch-ua",
+        "content-type",
+        "sec-ch-ua-mobile",
+        "accept",
+        "origin",
+        "sec-fetch-site",
+        "sec-fetch-mode",
+        "sec-fetch-dest",
+        "referer",
+        "accept-encoding",
+        "accept-language",
+        "cookie",
+    ],
+};
+const CHROME_H1_HEADER_NAMES = {
+    host: "Host",
+    connection: "Connection",
+    "upgrade-insecure-requests": "Upgrade-Insecure-Requests",
+    "user-agent": "User-Agent",
+    "accept-language": "Accept-Language",
+    accept: "Accept",
+    "sec-fetch-site": "Sec-Fetch-Site",
+    "sec-fetch-mode": "Sec-Fetch-Mode",
+    "sec-fetch-user": "Sec-Fetch-User",
+    "sec-fetch-dest": "Sec-Fetch-Dest",
+    "accept-encoding": "Accept-Encoding",
+    cookie: "Cookie",
+    "cache-control": "Cache-Control",
+    "x-requested-with": "X-Requested-With",
+    referer: "Referer",
+    "content-length": "Content-Length",
+    "content-type": "Content-Type",
+    origin: "Origin",
+    range: "Range",
+};
+function chromeHeaderOrder(requestClass, isHttp1, caller) {
+    if (isHttp1)
+        return CHROME_H1_HEADER_ORDERS[requestClass];
+    if (requestClass !== "xhr")
+        return CHROME_HEADER_ORDERS[requestClass];
+    // Cookie and Referer are forbidden Fetch headers, so they never enter the page
+    // Fetch Headers map the emulator models. Range does occupy a map bucket
+    // (m1-capture.json range_*), but HttpCache::Transaction removes it from the
+    // request headers and PartialData re-adds it at the tail.
+    const order = chrome149HeaderOrder([...caller.keys()].filter((name) => name !== "cookie" && name !== "referer"));
+    if (caller.has("range"))
+        order.splice(order.indexOf("range"), 1);
+    // //net appends Accept-Encoding and, unless the caller supplied one,
+    // Accept-Language (URLRequestHttpJob::AddExtraHeaders), then writes the Cookie
+    // header (SetCookieHeaderAndStart); the HTTP cache re-adds a caller Range after
+    // that, and the HTTP/2 Priority header stays last.
+    let insertAt = order.indexOf("accept-encoding") + 1;
+    if (order[insertAt] === "accept-language")
+        insertAt += 1;
+    for (const name of ["cookie", "range"]) {
+        if (!caller.has(name))
+            continue;
+        order.splice(insertAt, 0, name);
+        insertAt += 1;
+    }
+    return order;
+}
+function normalizedCallerHeaderEntries(headers) {
+    const entries = normalizedHeaderEntries(headers);
+    assertCallerHeadersSupported(entries);
+    return entries;
+}
+function normalizedCallerHeaderEntriesFromRecord(headers) {
+    // The record has been through normalizeHeaders (lowercase, merged names); the
+    // lowercase here only guards later insertions such as the cookie jar's header.
+    const entries = Object.entries(headers).map(([name, value]) => [
+        name.toLowerCase(),
+        value,
+    ]);
+    assertCallerHeadersSupported(entries);
+    return entries;
+}
+function assertCallerHeadersSupported(entries) {
+    for (const [name] of entries) {
+        if (SDK_OWNED_EXACT_CHROME_HEADERS.has(name) || name.startsWith("sec-fetch-")) {
+            throw new SDKError(`Stealth transport owns the "${name}" header; remove it from headers.`, {
+                code: "STEALTH_HEADER_OVERRIDE_UNSUPPORTED",
+            });
+        }
+    }
+}
+function chromeRequestClass(method, requestedClass) {
+    if (requestedClass)
+        return requestedClass;
+    if (method === "POST")
+        return "post";
+    return "navigation";
+}
+function secFetchSite(requestUrl, referer) {
+    if (!referer)
+        return "none";
+    try {
+        return new URL(referer).origin === new URL(requestUrl).origin ? "same-origin" : "cross-site";
+    }
+    catch {
+        return "cross-site";
+    }
+}
+function requiredEmulationHeader(headers, name) {
+    const value = headers.get(name);
+    if (value !== undefined)
+        return value;
+    throw new SDKError(`wreq-js Chrome emulation exposes no ${name} header.`, {
+        code: "STEALTH_PROFILE_UNAVAILABLE",
+    });
+}
+function buildChromeHeaderTuples(options) {
+    const callerEntries = normalizedCallerHeaderEntriesFromRecord(options.headers);
+    const caller = new Map(callerEntries);
+    const emulation = new Map(Array.from(options.emulationHeaders, ([name, value]) => [name.toLowerCase(), value]));
+    const requestClass = chromeRequestClass(options.method, options.requestClass);
+    const referer = caller.get("referer");
+    const fetchSite = secFetchSite(options.requestUrl, referer);
+    const isNavigation = requestClass === "navigation";
+    const values = new Map([
+        ["sec-ch-ua", requiredEmulationHeader(emulation, "sec-ch-ua")],
+        ["sec-ch-ua-mobile", requiredEmulationHeader(emulation, "sec-ch-ua-mobile")],
+        ["sec-ch-ua-platform", requiredEmulationHeader(emulation, "sec-ch-ua-platform")],
+        ["user-agent", requiredEmulationHeader(emulation, "user-agent")],
+        [
+            "accept-language",
+            caller.get("accept-language") ??
+                options.acceptLanguage ??
+                requiredEmulationHeader(emulation, "accept-language"),
+        ],
+        ["accept", isNavigation ? requiredEmulationHeader(emulation, "accept") : "*/*"],
+        [
+            "accept-encoding",
+            caller.has("range") ? "identity" : requiredEmulationHeader(emulation, "accept-encoding"),
+        ],
+        ["priority", isNavigation ? requiredEmulationHeader(emulation, "priority") : "u=1, i"],
+        ["sec-fetch-site", fetchSite],
+        ["sec-fetch-mode", isNavigation ? "navigate" : "cors"],
+        ["sec-fetch-dest", isNavigation ? "document" : "empty"],
+    ]);
+    if (isNavigation) {
+        values.set("upgrade-insecure-requests", "1");
+        values.set("sec-fetch-user", "?1");
+    }
+    for (const [name, value] of callerEntries)
+        values.set(name, value);
+    for (const name of ["content-type", "origin", "referer"]) {
+        const value = caller.get(name);
+        if (value !== undefined)
+            values.set(name, value);
+    }
+    if (requestClass === "post") {
+        values.set("content-length", caller.get("content-length") ?? String(Buffer.byteLength(options.body ?? "")));
+    }
+    const isHttp1 = new URL(options.requestUrl).protocol === "http:";
+    if (isHttp1) {
+        values.set("host", new URL(options.requestUrl).host);
+        values.set("connection", "keep-alive");
+    }
+    const order = chromeHeaderOrder(requestClass, isHttp1, caller);
+    const tuples = [];
+    const placed = new Set();
+    for (const name of order) {
+        const value = values.get(name);
         if (value === undefined)
             continue;
-        normalized[name] = Array.isArray(value) ? value.join(", ") : value;
+        tuples.push([isHttp1 ? (CHROME_H1_HEADER_NAMES[name] ?? name) : name, value]);
+        placed.add(name);
     }
-    return normalized;
+    for (const [name, value] of callerEntries) {
+        if (placed.has(name))
+            continue;
+        tuples.push([isHttp1 ? (CHROME_H1_HEADER_NAMES[name] ?? name) : name, value]);
+    }
+    return tuples;
 }
 function hasOwn(object, key) {
     return Object.hasOwn(object, key);
@@ -170,7 +415,7 @@ function assertNoUnsupportedFingerprintOverrides(options) {
         unsupported.push("stealth.h2");
     if (unsupported.length === 0)
         return;
-    throw new SDKError(`ctx.stealth.fetch uses transport-managed browser fingerprints and no longer accepts low-level stealth overrides: ${unsupported.join(", ")}. Use the profile option instead.`);
+    throw new SDKError(`ctx.stealth.fetch uses transport-managed browser fingerprints and no longer accepts low-level stealth overrides: ${unsupported.join(", ")}. Use stealth.browser and stealth.os instead.`);
 }
 function responseHeadersToRecord(headers) {
     const record = {};
@@ -575,26 +820,29 @@ function discardStealthRedirectBody(response) {
         // failure must not replace or delay that decision.
     }
 }
-async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, signal) {
+async function fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, signal, buildHeaders) {
     let currentUrl = requestUrl;
     let currentMethod = method;
     let currentBody = options.body === undefined ? undefined : normalizeBody(options.body);
-    let currentHeaders = { ...(options.headers ?? {}) };
+    let currentHeaders = normalizeHeaders({ ...(options.headers ?? {}) });
     let followedHops = 0;
     let response;
     const deadline = options.timeout ? performance.now() + options.timeout : undefined;
     while (true) {
         throwIfAmbientAborted(signal);
         const headers = { ...currentHeaders };
-        if (!hasHeader(headers, "Cookie")) {
+        if (!hasHeader(headers, "cookie")) {
             const cookieHeader = cookieJar.toHeader(currentUrl);
             if (cookieHeader)
-                headers.Cookie = cookieHeader;
+                headers.cookie = cookieHeader;
         }
         const requestInit = {
-            headers: normalizeHeaders(headers),
+            headers: buildHeaders
+                ? buildHeaders(currentUrl, currentMethod, currentBody, headers)
+                : headers,
             method: currentMethod,
             redirect: "manual",
+            ...(new URL(currentUrl).protocol === "http:" ? { disableDefaultHeaders: true } : {}),
             ...(signal ? { signal } : {}),
         };
         if (currentBody !== undefined)
@@ -653,24 +901,27 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
     let closed = false;
     let hasWarnedMissingProxy = false;
     const warn = clientOptions.warn ?? console.warn;
-    const intentAlias = getStealthProfileIntentAlias(defaultProfile);
-    if (intentAlias) {
-        warn(`[provider-sdk] Stealth profile "${defaultProfile}" pins a browser version and is deprecated. Use the intent profile "${intentAlias}" so TLS, headers, and User-Agent stay aligned with SDK updates; derive an explicit User-Agent with getStealthProfile("${intentAlias}").userAgent instead of hardcoding one.`);
-    }
     const cookieJar = new StealthCookieJar([], baseUrl);
-    async function getClientEntry(profileName, proxyUrl, ignoreTlsErrors) {
+    async function getClientEntry(profile, proxyUrl, ignoreTlsErrors, defaultHeaders) {
         if (closed) {
             throw new TransportError("Stealth session is closed", { status: 0 });
         }
         const wreq = await getWreqModule();
-        const { browser, os } = resolveWreqProfile(profileName, wreq.getProfiles());
-        const cacheKey = JSON.stringify({ browser, proxyUrl, ignoreTlsErrors });
+        const { browser, os } = resolveWreqProfile(profile, wreq.getProfiles());
+        const cacheKey = JSON.stringify({
+            browser,
+            os,
+            proxyUrl,
+            ignoreTlsErrors,
+            headerOrder: defaultHeaders?.map(([name]) => name),
+        });
         let entry = clients.get(cacheKey);
         if (!entry) {
             entry = {
                 session: wreq.createSession({
                     browser,
                     os,
+                    ...(defaultHeaders ? { defaultHeaders } : {}),
                     ...(proxyUrl ? { proxy: proxyUrl } : {}),
                     ...(ignoreTlsErrors ? { insecure: true } : {}),
                     timeout: 30_000,
@@ -681,9 +932,9 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
         }
         return entry;
     }
-    async function withClient(profileName, proxyUrl, ignoreTlsErrors, operation, signal) {
+    async function withClient(profile, proxyUrl, ignoreTlsErrors, operation, signal, defaultHeaders) {
         throwIfAmbientAborted(signal);
-        const entry = await getClientEntry(profileName, proxyUrl, ignoreTlsErrors);
+        const entry = await getClientEntry(profile, proxyUrl, ignoreTlsErrors, defaultHeaders);
         throwIfAmbientAborted(signal);
         const previous = entry.tail;
         let release;
@@ -761,9 +1012,11 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
     }
     const session = {
         async fetch(url, options = {}) {
+            const requestProfile = resolveStealthProfileSelection(options.stealth, defaultProfile);
             const { hasExplicitRetryPolicy, method, stealthRetryOptions } = (() => {
                 try {
                     const method = normalizeMethod(options.method ?? "GET");
+                    normalizedCallerHeaderEntries(options.headers ?? {});
                     const hasExplicitRetryPolicy = options.retry !== undefined;
                     const stealthRetryOptions = normalizeProxyTransportRetryOptions(options.retry, {
                         extraErrorCodes: STEALTH_PROXY_TRANSPORT_RETRY_ERROR_CODES,
@@ -870,10 +1123,32 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                         }
                         const ignoreTlsErrors = Boolean(options.stealth?.insecureSkipVerify ??
                             (!hasPolicyProxy && proxy && clientOptions.proxyStealth?.insecureSkipVerify));
-                        const profileName = options.profile ?? defaultProfile;
                         serializedUrl = serializeRequestUrl(resolveUrl(baseUrl, url), options.params, sensitiveParams);
                         const { requestUrl } = serializedUrl;
-                        const { normalized, response } = await withClient(profileName, proxy, ignoreTlsErrors, (transport) => fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, clientOptions.signal), clientOptions.signal);
+                        const wreq = await getWreqModule();
+                        const mapping = resolveWreqProfile(requestProfile, wreq.getProfiles());
+                        const chromeEmulationHeaders = mapping.browser.startsWith("chrome_")
+                            ? Array.from(wreq.getEmulationHeaders(mapping.browser, mapping.os), ([name, value]) => [String(name), String(value)])
+                            : undefined;
+                        const buildOrderedHeaders = chromeEmulationHeaders
+                            ? (currentUrl, currentMethod, currentBody, currentHeaders) => buildChromeHeaderTuples({
+                                emulationHeaders: chromeEmulationHeaders,
+                                method: currentMethod,
+                                body: currentBody,
+                                headers: currentHeaders,
+                                requestUrl: currentUrl,
+                                acceptLanguage: clientOptions.stealth?.acceptLanguage,
+                                requestClass: options.stealth?.requestClass,
+                            })
+                            : undefined;
+                        const initialHeaders = normalizeHeaders({ ...(options.headers ?? {}) });
+                        if (!hasHeader(initialHeaders, "cookie")) {
+                            const cookieHeader = cookieJar.toHeader(requestUrl);
+                            if (cookieHeader)
+                                initialHeaders.cookie = cookieHeader;
+                        }
+                        const defaultHeaders = buildOrderedHeaders?.(requestUrl, method, options.body === undefined ? undefined : normalizeBody(options.body), initialHeaders);
+                        const { normalized, response } = await withClient(requestProfile, proxy, ignoreTlsErrors, (transport) => fetchStealthRedirectChain(transport, cookieJar, requestUrl, method, options, clientOptions.signal, buildOrderedHeaders), clientOptions.signal, defaultHeaders);
                         if (proxy && isProxyConnectFailureResponse(response, normalized.body)) {
                             throw createProxyConnectFailureError(normalized.body);
                         }
@@ -985,7 +1260,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
                     continue;
                 }
                 const proxyAuthDiagnostic = stalePoolError && stalePoolDiagnosticProxy
-                    ? await classifyProxyAuthDiagnostic(options.profile ?? defaultProfile, stalePoolDiagnosticProxy)
+                    ? await classifyProxyAuthDiagnostic(requestProfile, stalePoolDiagnosticProxy)
                     : undefined;
                 if (proxyAuthDiagnostic === "source_ip_denied") {
                     throw createProxyAuthIpDeniedError(stalePoolError instanceof Error ? stalePoolError : undefined);
@@ -1192,9 +1467,9 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
         },
     };
     return session;
-    async function classifyProxyAuthDiagnostic(profileName, proxy) {
+    async function classifyProxyAuthDiagnostic(profile, proxy) {
         try {
-            return await withClient(profileName, proxy, false, async (client) => {
+            return await withClient(profile, proxy, false, async (client) => {
                 throwIfAmbientAborted(clientOptions.signal);
                 await client.clearCookies();
                 throwIfAmbientAborted(clientOptions.signal);
@@ -1237,13 +1512,15 @@ function hasHeader(headers, name) {
     const needle = name.toLowerCase();
     return Object.keys(headers).some((key) => key.toLowerCase() === needle);
 }
-export function createStealthClient(baseUrl, defaultProfileOrOptions = DEFAULT_PROFILE, clientOptions = {}) {
-    const defaultProfile = typeof defaultProfileOrOptions === "string" ? defaultProfileOrOptions : DEFAULT_PROFILE;
-    const resolvedClientOptions = typeof defaultProfileOrOptions === "string" ? clientOptions : defaultProfileOrOptions;
+export function createStealthClient(baseUrl, clientOptions = {}) {
+    if (typeof clientOptions === "string") {
+        resolveStealthProfileSelection(clientOptions);
+    }
+    const defaultProfile = resolveStealthProfileSelection(clientOptions.stealth);
     let sharedSession = null;
     function getSharedSession() {
         if (!sharedSession) {
-            sharedSession = createSessionFetcher(baseUrl, defaultProfile, resolvedClientOptions);
+            sharedSession = createSessionFetcher(baseUrl, defaultProfile, clientOptions);
         }
         return sharedSession;
     }
@@ -1252,8 +1529,8 @@ export function createStealthClient(baseUrl, defaultProfileOrOptions = DEFAULT_P
             return getSharedSession().fetch(url, options);
         },
         createSession(opts) {
-            const sessionProfile = opts?.profile ?? defaultProfile;
-            return createSessionFetcher(baseUrl, sessionProfile, resolvedClientOptions);
+            const sessionProfile = resolveStealthProfileSelection(opts?.stealth, defaultProfile);
+            return createSessionFetcher(baseUrl, sessionProfile, clientOptions);
         },
         close() {
             sharedSession?.close();

package/dist/runtime/trace-config.js

@@ -4,6 +4,7 @@ export const APIFUSE__TRACE__EXPORTER = "APIFUSE__TRACE__EXPORTER";
 const TRACE_EXPORTER_LOOKUP = {
     console: true,
     json: true,
+    otlp: true,
     none: true,
 };
 const TRACE_EXPORTERS = new Set(Object.keys(TRACE_EXPORTER_LOOKUP));
@@ -52,7 +53,7 @@ export function resolveTraceConfigFromEnv(env = process.env) {
             ? undefined
             : "none";
     if (exporterRaw !== undefined && exporter === "none" && normalizedExporter !== "none") {
-        warnOnce(APIFUSE__TRACE__EXPORTER, `[apifuse] Invalid APIFUSE__TRACE__EXPORTER value "${normalizedExporter ?? exporterRaw}" (OTLP is unsupported for server output); supported exporters are "console", "json", and "none"; falling back to exporter "none".`);
+        warnOnce(APIFUSE__TRACE__EXPORTER, `[apifuse] Invalid APIFUSE__TRACE__EXPORTER value "${normalizedExporter ?? exporterRaw}"; supported exporters are "console", "json", "otlp", and "none"; falling back to exporter "none".`);
     }
     return {
         ...(enabled !== undefined ? { enabled } : {}),

package/dist/runtime/trace.d.ts

@@ -10,6 +10,11 @@ export interface CreateTraceContextOptions {
     onSpan?: (span: Span) => void;
     exportOptions?: OTLPExportOptions;
     resourceAttributes?: Record<string, string>;
+    /**
+     * Applied to a detached copy of each span immediately before OTLP export; never touches
+     * getSpans() or onSpan. Returning nothing (or throwing) drops that export batch.
+     */
+    sanitizeSpanForExport?: (span: Span) => Span | undefined;
 }
 type SpanHookOptions<T> = {
     attributes?: Record<string, unknown>;